This vulnerability in gedelumbung HospitalManagement affects the Password Change Handler component, specifically the functions application/modules/global/controllers/password.php::simpan and application/modules/global/controllers/profil.php::simpan. Improper validation or manipulation of the argument kode_user/username leads to improper authentication, potentially allowing unauthorized access. The attack vector is remote with low attack complexity and no user interaction required. The product follows a rolling release model, so no discrete version numbers are provided for affected or fixed releases. The vendor has not yet responded to the issue report. The CVSS 4.0 base score is 5.3 (medium severity).

Successful exploitation allows an attacker to bypass authentication controls by manipulating user identification parameters during password change operations. This could lead to unauthorized access to user accounts or sensitive functions within the HospitalManagement system. The vulnerability is remotely exploitable without user interaction and requires low privileges to attempt.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the affected password change endpoints or implementing additional authentication checks as a temporary measure.